Leadership & Organization — 2026-03-25
CISA Acting Director Warns DHS Shutdown Creating Accumulating Cyber Risk; Six Threat Hunters Resign in One Day
CISA Acting Director Nick Andersen testified before the House Homeland Security Committee on March 25 that risks are "accumulating across the system" due to the DHS shutdown, now in its 40th day. Andersen reported 60% of CISA workforce is furloughed, 1,000 positions are vacant, and six members of a specialized threat hunting and incident response team resigned in a single day. The agency is restricted to responding to immediate threats and maintaining its 24/7 operations center, with proactive assessments, coordinated planning, and partnership engagement paused. Andersen warned the shutdown will create "downstream impacts" on future recruitment, compounding retention losses during active Iranian cyber threats.
Analysis
Prior IC Brief reported CISA at 33% capacity; today Andersen testified it has risen to 38% through excepted personnel designations, but six specialized threat hunters resigning in one day signals the shutdown damage is deepening rather than stabilizing. The 329-hire approval andMaxiflex reinstatement represent a policy reversal, but cannot execute while two-thirds of staff remain furloughed. The timing, during active Iranian cyber campaigns against US critical infrastructure, compounds the operational risk.
Prior IC Brief reported CISA at 33% capacity; today Andersen testified it has risen to 38% through excepted personnel designations, but six specialized threat hunters resigning in one day signals the shutdown damage is deepening rather than stabilizing. The 329-hire approval and